The platform audit log
Find who did what anywhere on the installation, and export it.
This page is for self-hosted installations. On GoRunner Cloud, GoRunner runs this for you. See Audit log.
In Platform, under Installation, open Audit log. Each organization’s admins see their own part in their audit log; this one holds every organization’s, and the installation’s own.
Its views
- People and admins
- Sign-ins, changes and admin acts, newest first.
- Admin visits
- Each visit: who, where, why, how long, and how many changes. A row opens its timeline.
- Your app’s API
- Your server’s calls to the partner API, with an Embed license.
- Automatic
- What GoRunner did by itself, as hourly totals.
Find an event
- Type a person, an act or a place in the search, or press /.
- Narrow it with Who, Organization and the period, from 24 hours to All time, or Custom.
- Select a row. Its detail shows the values before and after, its visit, the route and the address it came from.
Export it
Export CSV downloads the events as filtered, every page of them, up to 100,000. Past that, the file’s last row says to narrow the period for the rest; otherwise it says the file is complete. A download cut short is never saved. It needs a license that includes Audit export.
How long it is kept
The foot says Kept forever, or how many days. Rows older than AUDIT_RETENTION_DAYS are deleted every hour; set it in .env and restart. Change opens the start-up settings on Monitoring.
That setting deletes every kind of row, security events included. To keep the log and only shrink it, set AUDIT_CREDENTIAL_USE_RETENTION_DAYS instead: it deletes just the credential use GoRunner itself recorded, and each connection keeps its latest use. Empty keeps everything. See Settings (.env).
Why does it name people, when monitoring doesn’t?
“Who did it” is the audit log’s whole point. It stays in GoRunner, for admins. An organization can stream its own part to its tools with event streaming.
Related
Checked against 12d85b3b